nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

ldls: ping, over a Linux driver

Browse source 
docs/plan/ldls.md L3d, and with it L3 -- the milestone the plan calls the one
that proves the whole idea and the one that cannot be skipped.

    # ldlsd /lib/modules/8139too.ko /lib/modules/btf &
      kpi: the driver read a MAC off the hardware: 52:54:00🆎cd:ef
      ndo_open returned 0
      carrying frames. the interface is ldls0.

    # cat /proc/netif
    interface ldls0   state up   address 10.9.0.15   gateway 10.9.0.2

    # ping 10.9.0.2 4
    64 bytes from 10.9.0.2: icmp_seq=1 time=30 ms
    64 bytes from 10.9.0.2: icmp_seq=2 time=20 ms
    64 bytes from 10.9.0.2: icmp_seq=3 time=20 ms
    64 bytes from 10.9.0.2: icmp_seq=4 time=20 ms

10.9.0.0/24 is reachable only through ldls0, and ldls0 is 8139too running in a
SchOS process. The address was obtained by DHCP over the same driver first.
lwIP -> netdev_ops -> /dev/netdev -> ldlsd -> ndo_start_xmit -> a BAR mapped by
/dev/pci -> the wire, and the whole way back. Nothing in the kernel knows a
Linux driver is involved; nothing in the driver knows it is not in Linux.

It polls rather than taking interrupts. /dev/pci delivers them by blocking
read(), which needs a thread this program does not have, so the driver's NAPI
poll is called from a loop instead -- the same work in a context LDLS can
provide, at the cost of latency and a spinning process.

Four things Linux's alloc_etherdev does that allocating does not, each found by
the driver faulting on it: dev->dev_addr is a pointer aimed at perm_addr;
dev->mc and dev->uc are list heads and are empty only when they point at
themselves; dev->_tx is an array of netdev_queue, because netif_start_queue
clears a bit in _tx[0].state; and __LINK_STATE_START is set by dev_open before
ndo_open is called.

Two did not announce themselves, and they are the ones worth recording.

netif_running(dev) gates 8139too's receive loop. Without it the chip received
the frame, the driver acknowledged the interrupt and left the loop, and nothing
came out -- while every counter said packets were arriving. Found by reading
the chip's own CBR register through the BAR and seeing the hardware had written
600 bytes the driver never collected.

memcpy was still a logging stub. The driver copied each frame into its sk_buff,
the copy did not happen, and the stack was handed exactly the right length of
zeroes; DHCP never completed and nothing reported an error. A stub that returns
zero is not safe for a function whose whole job is a side effect, and the
memory primitives are the worst case because they fail silently and plausibly.
ldls/kpi/string.c exists because of it.

Still one driver, one kernel version, tried once, against an emulated card --
which is what the plan has always promised and is worth repeating next to a
working ping.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz 2026-09-14 11:14:18 +02:00
commit 888c48fd96
9 changed files with 809 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

164
cmd/ldlsd/main.c
View file

@ -31,6 +31,9 @@
#include "pciuser.h"
#include "kpi/kpi.h"
extern void kpi_unregister_netdev(void *dev);
extern void *kpi_skb_alloc(unsigned int len);
extern void *kpi_skb_put(void *skb, unsigned int n);
extern void *kpi_netdev(void);
// --- small output, since lib/ has no printf ---------------------------------
@ -337,6 +340,157 @@ lay(struct btf *b, const char *type, const char *member)
#define LDLS_IORESOURCE_IO 0x00000100
#define LDLS_IORESOURCE_MEM 0x00000200
// Fill in the offsets the KPI needs, from the same BTF the PCI ones came from.
static int
kpi_layout_from_btf(struct btf *b)
{
unsigned int off, size;
int nd, ops, skb;
nd = btf_find(b, "net_device", BTF_KIND_STRUCT);
ops = btf_find(b, "net_device_ops", BTF_KIND_STRUCT);
skb = btf_find(b, "sk_buff", BTF_KIND_STRUCT);
if (!nd || !ops || !skb) {
puts_("ldlsd: this BTF is missing net_device, net_device_ops or "
"sk_buff\n");
return -1;
}
#define GET(id, name, field) \
do { if (btf_member_off(b, id, name, &off, &size) < 0) { \
puts_("ldlsd: no "); puts_(name); puts_("\n"); return -1; } \
field = off; } while (0)
GET(nd, "netdev_ops", kpi_l.nd_netdev_ops);
GET(nd, "dev_addr", kpi_l.nd_dev_addr);
GET(nd, "perm_addr", kpi_l.nd_perm_addr);
GET(nd, "addr_len", kpi_l.nd_addr_len);
GET(nd, "mc", kpi_l.nd_mc);
GET(nd, "uc", kpi_l.nd_uc);
GET(nd, "_tx", kpi_l.nd_tx);
GET(nd, "num_tx_queues", kpi_l.nd_num_tx);
GET(nd, "real_num_tx_queues", kpi_l.nd_real_num_tx);
GET(nd, "state", kpi_l.nd_state);
GET(nd, "flags", kpi_l.nd_flags);
{
int nq = btf_find(b, "netdev_queue", BTF_KIND_STRUCT);
if (!nq) { puts_("ldlsd: no struct netdev_queue\n"); return -1; }
kpi_l.nq_size = btf_type_size(b, nq);
GET(nq, "dev", kpi_l.nq_dev);
}
GET(ops, "ndo_open", kpi_l.ndo_open);
GET(ops, "ndo_stop", kpi_l.ndo_stop);
GET(ops, "ndo_start_xmit", kpi_l.ndo_start_xmit);
GET(skb, "len", kpi_l.skb_len);
GET(skb, "data", kpi_l.skb_data);
GET(skb, "head", kpi_l.skb_head);
GET(skb, "tail", kpi_l.skb_tail);
GET(skb, "end", kpi_l.skb_end);
GET(skb, "dev", kpi_l.skb_dev);
#undef GET
kpi_l.skb_size = btf_type_size(b, skb);
return 0;
}
// Bring the interface up and carry frames.
//
// **This polls.** A Linux driver expects its interrupt handler to be called
// from an interrupt, and /dev/pci does deliver them -- by blocking read, which
// needs a thread this program does not have. Calling the handler from a loop
// is the same work in a context LDLS can actually provide, and it costs
// latency and a spinning process. The honest shape here, and it is written
// down as a limitation rather than hidden.
//
// A NAPI driver splits the work: the handler acknowledges the chip and
// schedules, and the poll takes packets off it. Both are called, in that
// order, which is the order a kernel would call them in.
static void
run_interface(struct btf *b, void *ndev)
{
void *ops, *open_fn, *xmit_fn;
unsigned char frame[1600];
long tx = 0, rx = 0, idle = 0;
ops = (void *)rd64((unsigned long)ndev, kpi_l.nd_netdev_ops);
if (!ops) { puts_(" the driver published no netdev_ops\n"); return; }
open_fn = (void *)rd64((unsigned long)ops, kpi_l.ndo_open);
xmit_fn = (void *)rd64((unsigned long)ops, kpi_l.ndo_start_xmit);
if (!open_fn || !xmit_fn) {
puts_(" the driver has no ndo_open or no ndo_start_xmit\n");
return;
}
// netif_running(dev) has to be true before ndo_open, not after.
//
// Linux's dev_open() sets __LINK_STATE_START *before* calling the driver,
// and 8139too's receive loop is gated on it: without it the driver saw the
// packet arrive, found netif_running false, left the loop immediately and
// acked the interrupt -- so the chip's buffer filled, its status cleared,
// and nothing came out. That is a silent failure with no error anywhere,
// and it was found by reading the chip's own CBR register rather than by
// anything the driver said.
//
// IFF_UP too, for the same class of reason.
{
unsigned char *d = (unsigned char *)ndev;
d[kpi_l.nd_state] |= 1; /* __LINK_STATE_START */
d[kpi_l.nd_flags] |= 1; /* IFF_UP */
}
puts_("\n calling ndo_open\n\n");
{
int (*op)(void *) = (int (*)(void *))open_fn;
int r = op(ndev);
puts_("\n ndo_open returned "); putn(r); puts_("\n");
if (r != 0) { puts_(" the interface will not come up\n"); return; }
}
puts_("\n carrying frames. the interface is ldls0.\n\n");
for (;;) {
int n, moved = 0;
// Anything the stack wants sent. The descriptor is non-blocking, so
// this returns immediately when there is nothing -- the receive side
// has to be given a turn either way.
n = read(kpi.netfd, (char *)frame, (int)sizeof(frame));
if (n > 0) {
void *skb = kpi_skb_alloc((unsigned int)n);
if (skb) {
unsigned char *d = kpi_skb_put(skb, (unsigned int)n);
int i;
for (i = 0; i < n; i++) d[i] = frame[i];
{
int (*xmit)(void *, void *) =
(int (*)(void *, void *))xmit_fn;
xmit(skb, ndev);
}
tx++;
moved = 1;
}
}
// And anything the chip has. The driver's own poll does the work; all
// this decides is when it gets to run.
if (kpi_napi_poll) {
int got = kpi_napi_poll(kpi_napi, 16);
if (got > 0) { rx += got; moved = 1; }
}
if (!moved) {
if (++idle > 200) { sleep(1); idle = 0; }
} else {
idle = 0;
if (((tx + rx) % 64) == 0) {
puts_(" ldls0: tx "); putn(tx);
puts_(" rx "); putn(rx); puts_("\n");
}
}
}
}
static void
drive_probe(const char *btfpath)
{
@ -457,6 +611,11 @@ drive_probe(const char *btfpath)
puts_(" netdev "); putn(kpi_netdev_size); puts_(" bytes\n");
}
// Before probe, not after: alloc_etherdev_mqs runs *during* probe and
// needs net_device's offsets to set dev->dev_addr up.
if (kpi_layout_from_btf(&b) < 0)
return;
// Counted over the *symbol list*, not over resolutions: a symbol is
// resolved once per relocation that names it, and reporting that number
// would have said 275 of 94.
@ -479,6 +638,11 @@ drive_probe(const char *btfpath)
puts_(" after "); putn(g_calls); puts_(" stub call(s)\n");
if (r == 0 && kpi.netfd >= 0) {
// The *net_device*, not the pci_dev. See kpi_netdev().
run_interface(&b, kpi_netdev());
return;
}
if (0) {
// The driver is up on real hardware and has registered an
// interface. What is *not* built is the path that carries
// frames -- ndo_open, ndo_start_xmit and the receive side.